[Hack The Box] HTB—Driver walkthrough

本文详细介绍了在Hack The Box平台上的Driver机器的渗透测试过程，包括信息搜集、SMB共享利用（SCF文件攻击、Net-NTLMv2哈希抓取）、NTLMv2哈希爆破、利用Evil-WinRM进行远程连接以及通过CVE-2021-1675提权到管理员权限，最终获取到系统的所有flag。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

[Hack The Box] HTB—Driver walkthrough

HTB—Driver

[Hack The Box] HTB—Driver walkthrough
一、信息搜集
二、SMB Share – SCF File Attacks && Net-NTLMv2 hash grabbing
- NTLMv2
- evil-winrm
三、提权

machine ： Hack The Box——Driver

一、信息搜集

nmap -sV 10.10.11.106

nmap -sC -sV -n -T5 -p 135,80,445 10.10.11.106

得到

PORT    STATE SERVICE      VERSION
80/tcp  open  http         Microsoft IIS httpd 10.0
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
| http-methods: 
|_  Potentially risky methods: TRACE
| http-auth: 
| HTTP/1.1 401 Unauthorized\x0D
|_  Basic realm=MFP Firmware Update Center. Please enter password for admin
|_http-server-header: Microsoft-IIS/10.0
135/tcp open  msrpc        Microsoft Windows RPC
445/tcp open  microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)
Service Info: Host: DRIVER; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-time: 
|   date: 2022-02-22T10:34:47
|_  start_date: 2022-02-22T04:38:42
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled but not required
|_clock-skew: mean: 7h17m39s, deviation: 0s, median: 7h17m38s